From: Ken Goldman <kgold@linux.ibm.com>
To: david.safford@gmail.com, Mimi Zohar <zohar@linux.ibm.com>,
linux-integrity@vger.kernel.org,
linux-security-module <linux-security-module@vger.kernel.org>
Cc: monty.wiseman@ge.com
Subject: Re: [PATCH v2] ima: export the measurement list when needed
Date: Thu, 13 Feb 2020 15:11:30 -0500 [thread overview]
Message-ID: <f095a412-9967-416d-a4d9-d3b5799f8409@linux.ibm.com> (raw)
In-Reply-To: <fab03a0b8cc9dc93f2d0db51071521ce82e2b96b.camel@gmail.com>
On 2/11/2020 11:10 AM, david.safford@gmail.com wrote:
> There is no reason to resend the same data for every attestation,
> nor is there any reason to store already attested measurements anywhere
> on the client. By versioning the log file names, userspace gets a
> simple way to know what has and has not been attested, and for small
> embedded devices we don't need to waste memory or filesystem space
> on the data already attested.
Yes ... no.
There isn't any reason to resend measurements that a verifier has
already received. In fact, the logic I coded also said "if PCR 10
didn't change, there's no need to even ask for the measurement log".
However, don't you have to save already attested measurements for
the case where there are multiple verifiers? A different verifier would
have to receive all measurements.
next prev parent reply other threads:[~2020-02-13 20:11 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-08 11:17 [PATCH v2] ima: export the measurement list when needed Janne Karhunen
2020-01-10 8:48 ` Janne Karhunen
2020-01-22 15:56 ` Mimi Zohar
2020-01-23 8:41 ` Janne Karhunen
2020-01-26 17:01 ` Mimi Zohar
2020-01-27 9:03 ` Janne Karhunen
2020-02-06 14:13 ` Mimi Zohar
2020-02-10 8:04 ` Janne Karhunen
2020-02-10 15:26 ` Mimi Zohar
2020-02-10 18:18 ` david.safford
2020-02-10 20:24 ` Mimi Zohar
2020-02-11 8:06 ` Janne Karhunen
2020-02-11 16:10 ` david.safford
2020-02-11 23:10 ` Mimi Zohar
2020-02-12 21:08 ` david.safford
2020-02-13 1:03 ` Mimi Zohar
2020-02-13 6:41 ` Janne Karhunen
2020-02-18 15:36 ` Mimi Zohar
2020-02-13 20:11 ` Ken Goldman [this message]
2020-02-18 14:50 ` david.safford
2020-01-24 14:46 ` david.safford
2020-01-27 8:48 ` Janne Karhunen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f095a412-9967-416d-a4d9-d3b5799f8409@linux.ibm.com \
--to=kgold@linux.ibm.com \
--cc=david.safford@gmail.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=monty.wiseman@ge.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).